Fed and OCC Check Banks for Exposure After Binance Cyberattack

Regulators test whether banks saw disruption

Federal Reserve and Office of the Comptroller of the Currency supervisors began contacting U.S. banks on Monday morning, asking whether they had detected unusual activity or experienced disruption to services. Reuters reported the outreach, citing people familiar with the matter. The inquiries followed the previous week’s reported $6.3 billion hack of Binance and indicate that supervisors wanted to establish whether the incident had any operational signs beyond the exchange itself.

One bank contacted by regulators reported no service disruption, according to a source cited by Reuters. Staff at that institution prepared talking points in case customers asked about the incident, but received few inquiries. The account offers a limited view of customer response and does not establish how other banks fared. The regulators’ questions were focused on unusual activity and continuity of services, rather than a publicly announced finding that banks had been compromised.

The outreach suggests supervisors are treating a major crypto-platform breach as a potential concern for traditional finance as well as for the exchange involved. That distinction matters because banks and crypto companies have become more closely connected, according to the report. The contact with banks was a check for possible exposure; the source material does not say that regulators found a link between the Binance theft and any U.S. bank system, or that bank services were affected.

A long-running attack raises broader cyber questions

Banks have also been examining the attack on their own initiative. Two people familiar with those efforts told Reuters that institutions were running diagnostics to assess whether their systems could withstand similar tactics. The reported work is a review of defenses, not evidence that the same methods were used against those banks. The account does not identify all participating institutions or specify what the diagnostics found, leaving the results of the broader checks unclear.

Within hours of the breach, a cybersecurity team at one of the largest U.S. banks contacted counterparts at Binance, according to the report. The bank team is preparing an internal report that will lead to a review of its systems and could result in cybersecurity updates. It remained unclear whether the bank was vulnerable to the tactics described by Binance. The sequence shows a rapid technical response, while the final assessment and any changes remain pending.

A person familiar with the response identified the fast evolution of artificial-intelligence models as a leading concern, saying it can make it difficult for banks to keep pace with hackers. Banks are committing substantial resources to reviewing and patching cybersecurity code, the report said. Binance, meanwhile, said it was unaware of conversations between banks and regulators or whether its breach had affected U.S. banks. A spokesperson said the company was keeping regulators worldwide informed.

Expanding bank-crypto ties sharpen oversight

Binance described an attack that began with a fake job interview and continued for five months before any coins moved. The campaign reportedly combined a poisoned software download with a staged recruitment process, malware that evaded endpoint detection, and an internal AI tool turned against the company’s wallet engineers. Those details point to a prolonged effort involving people and technology, rather than a single sudden intrusion. The source does not describe the interview target’s identity.

Funds began leaving Binance hot wallets across multiple blockchains on Oct. 29, according to the account. The cross-chain movement is part of why the event attracted attention beyond one wallet or network, although the supplied details do not specify the quantities moved on each chain. Blockchain analysis firms Chainalysis and TRM Labs linked the hack to TraderTraitor, a unit associated with North Korea. The report presents that attribution as the firms’ assessment.

Binance reopened withdrawals in stages four days after the movement began, starting with bitcoin. The exchange said it froze or intercepted about $2.85 billion of the stolen assets and replenished 98% of affected tokens using its own funds. Those figures describe Binance’s account of its response; the report does not provide an independent reconciliation of the assets or explain the status of every remaining token. The scale and recovery claims should therefore be distinguished from the initial theft figure.

No new guidance announced as reviews continue

The methods Binance described are not confined to crypto businesses. Social engineering, malicious downloads and compromised internal tools are also risks for large financial institutions, a point that helps explain why bank cybersecurity teams reportedly responded within hours. The practical concern for lenders is whether a familiar class of attack could exploit their own systems or staff. The source reports reviews and diagnostics, but does not establish that banks have encountered the same campaign.

The supervisory checks come after changes that have made it easier for U.S. banks to take on certain crypto activities. In March 2025, the OCC rescinded a requirement for national banks to obtain supervisory non-objection before conducting crypto custody and stablecoin activities. The following month, the Federal Reserve withdrew guidance requiring state member banks to notify it before beginning crypto activities. These steps form the regulatory backdrop to closer scrutiny of a crypto breach.

As banks custody bitcoin, issue stablecoins and serve exchanges, supervisors may have reason to consider how incidents at crypto firms intersect with bank operations. The report also notes a separate cyberattack at French lender Credit Mutuel Arkea: fraudulent transfers were made from its own account, while the bank said customers were unaffected. An onchain investigator put the theft above $133 million, a figure the bank had not confirmed. Neither the Fed nor OCC has announced Binance-related new guidance, and the U.S. banks’ review outcomes remain uncertain.

Source: BitcoinMagazine